Log Analysis for Suspicious Activity | Dataford Interview Questions

Write a function to analyze log files for suspicious activity.

Implement analyze_logs(logs), where logs is a list of dictionaries containing integer timestamp, string ip, and string event fields. Return sorted IP addresses with at least three login_failed events occurring within any 300-second inclusive window; ignore other events. Examples: timestamps [0, 150, 300] return the IP, while [0, 301, 602] does not. Constraints: 0 <= len(logs) <= 100, timestamps are nonnegative integers, and each log has all required fields.

Constraints

0 <= len(logs) <= 100
Each log contains integer timestamp, string ip, and string event fields
Timestamps are nonnegative integers
Only events equal to login_failed are considered
A 300-second window is inclusive at both ends

Function Signature

def analyze_logs(logs):

Your question is Log Analysis for Suspicious Activity. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a function to analyze log files for suspicious activity.

Constraints

0 <= len(logs) <= 100
Each log contains integer timestamp, string ip, and string event fields
Timestamps are nonnegative integers
Only events equal to login_failed are considered
A 300-second window is inclusive at both ends

Function Signature

def analyze_logs(logs):

Your question is Log Analysis for Suspicious Activity. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.